WO2015191300A1

WO2015191300A1 - Provisioning and managing slices of a consumer premises equipment device

Info

Publication number: WO2015191300A1
Application number: PCT/US2015/032968
Authority: WO
Inventors: Mark J. Baugher; Plamen Nedeltchev; Luka PERKOV; Tara K. THIMMANAIK
Original assignee: Cisco Technology, Inc.
Priority date: 2014-06-09
Filing date: 2015-05-28
Publication date: 2015-12-17
Also published as: EP3152865A1; US20150358399A1; CN106464534B; EP3152865B1; CN106464534A

Abstract

At a customer premises equipment comprising one or more network interfaces, an instruction to provision a slice of the customer premises equipment (CPE) for a tenant application is received from a root network manager. The instruction identifies at least one network interface of the one or more network interfaces to allocate to the slice. The slice of the CPE is provisioned, where provisioning the slice comprises allocating CPE resources including the at least one network interface to the slice of the customer premises equipment. The tenant application is obtained. Data associating the tenant application with the slice of the CPE is stored. A management instruction for managing the tenant application is received directly from a secondary network manager associated with the tenant application. The management instruction is executed only in relation to the slice.

Description

PROVISIONING AND MANAGING SLICES OF A CONSUMER PREMISES EQUIPMENT DEVICE

FIELD OF THE DISCLOSURE

[0001] The disclosure generally relates to techniques for network device management. The disclosure relates more specifically to techniques for provisioning and managing slices of a consumer premises equipment device.

BACKGROUND

[0002] The approaches described in this section are approaches that could be pursued, but not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated, it should not be assumed that any of the approaches described in this section qualify as prior art merely by virtue of their inclusion in this section.

[0003] Consumer premises equipment ("CPE" or "CPE device") is a device, such as a router, switch, internet access gateway, telephone, or a set-top box that is located at a subscriber premise and is connected to a telecommunications service provider, such as an internet service provider (ISP). For example, a CPE may be a router in a subscriber's home or office that obtains an internet connection from an ISP and provides the internet connection to other devices in the home, such as laptops, personal computers, and mobile devices in a subscriber network. In such a case, a network manager operated by an ISP typically manages the CPE by providing configuration instructions and monitoring requests to the CPE.

[0004] A user of a home network may wish to use the CPE for other services that are provided by third-party service providers that are different than the ISP such as, for example, home security services provided by a home security provider, teleworking service provided by a teleworking service provider, home automation services provided by a home automation provider, or entertainment services provided by an entertainment service provider.

BRIEF DESCRIPTION OF THE DRAWINGS

[0005] In the drawings:

[0006] FIG. 1 illustrates an example computer system including a consumer premises equipment that comprises a plurality of slices and a plurality of network managers that manage corresponding slices of the consumer premises equipment; [0007] FIG. 2 illustrates an example process of provisioning a slice of a CPE for a tenant application and managing of the tenant application by a secondary network manager;

[0008] FIG. 3 illustrates an example process of a CPE obtaining a tenant application;

[0009] FIG. 4 illustrates another example process of obtaining a tenant application;

[0010] FIG. 5 is a block diagram that illustrates a computer system upon which embodiments of the disclosure may be implemented.

SUMMARY

[0011] The appended claims may serve as a summary of the disclosure. DESCRIPTION OF EXAMPLE EMBODIMENTS

[0012] In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. It will be apparent, however, that the present disclosure may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to avoid unnecessarily obscuring the present disclosure.

[0013] Embodiments are described herein according to the following outline:

1.0 General Overview

2.0 Structural and Functional Overview

3.0 Implementation Mechanisms— Hardware Overview

4.0 Extensions and Alternatives

[0014] 1.0 GENERAL OVERVIEW

[0015] Techniques for provisioning and managing slices of a consumer premises equipment are described. In one approach, network managers controlled by third-party service providers (the "third-party network managers") may communicate with the CPE by sending communications to the CPE through a network manager operated by another entity, such as an ISP or a business that installed the router ("primary entity network manager"). However, such an approach results in disadvantages for both the primary entity and the third- party service providers. In such an approach, the primary entity network manager may have complete access to the communications sent from or to the third-party network managers and the third-party network managers must rely on the primary entity network manager for the transmission of each communication to or from the CPE. Additionally, the primary entity must bear the computing overhead caused by transmitting and receiving the additional traffic associated with the third-party network managers. As a result, improved approaches for allowing multiple service providers to use the same CPE are needed.

[0016] In an embodiment, a slice provisioning instruction to provision a slice of a customer premises equipment (CPE) for a tenant application is received at a customer premises equipment comprising one or more network interfaces from a root network manager. The slice provisioning instruction identifies at least one network interface of the one or more network interfaces to allocate to the slice. The slice of the CPE is provisioned, where provisioning the slice comprises allocating CPE resources including the at least one network interface to the slice of the customer premises equipment. The tenant application is obtained. Data associating the tenant application with the slice of the CPE is stored. A management instruction for managing the tenant application is received directly from a secondary network manager associated with the tenant application. The management instruction is executed only in relation to the slice.

[0017] 2.0 STRUCTURAL AND FUNCTIONAL OVERVIEW

[0018] FIG. 1 illustrates an example computer system including a consumer premises equipment that comprises a plurality of slices and a plurality of network managers that manage corresponding slices of the consumer premises equipment. CPE 102 is consumer premises equipment such as router, switch, internet access gateway, telephone, or set-top box that is located at a subscriber premise.

[0019] CPE 102 is communicatively coupled with telecommunications service provider 138, which may own CPE 102 and may be an ISP server that sends and receives internet traffic to and from CPE 102 through network 110. CPE 102 is also communicatively coupled with tenant service provider 122 and tenant service provider 124 through network 110. Tenant service provider 122 may operate secondary network manager 114 and tenant service provider 124 may operate secondary network manager 116.

[0020] In an embodiment, tenant service provider 122, tenant service provider 124, telecommunications service provider 138 may be each be different entities. For example, telecommunications service provider 138 may be an ISP and tenant service provider 122 and tenant service provider 124 may each be different non-ISP entities that provide different services to the subscriber through CPE 102, such as teleworking services, home security services, home automation services, entertainment services, or other services. In other embodiments, the same service provider (e.g., telecommunications service provider 138) may operate both root network manager 112 and each of secondary network manager 114 and secondary network manager 116. In yet another embodiment, a single tenant service provider may operate both secondary network manager 122 and 124 but the tenant service provider may be a different entity than telecommunications service provider 138.

[0021] Root network manager 112 may manage CPE 102 by performing various functions such as configuration and monitoring of CPE 102. Root network manager 112 may be operated by telecommunications service provider 138 and may perform management operations upon CPE 102 on behalf of telecommunications service provider 138. In other embodiments, root network manager 112 may be operated by a subscriber that owns CPE 102 and subscribes to the telecommunications services of telecommunications service provider 138. For example, in some embodiments, root network manager 112 may be an application installed on a mobile device or personal computer owned by the subscriber.

[0022] Root network manager 112 may send slice provisioning instructions to CPE 102 that cause CPE 102 to provision one or more CPE slices for one or more tenant applications. A CPE slice, as used herein, is a set of CPE resources, which may include one or more network interfaces of the CPE and one or more network prefixes. Each slice may be associated with a secondary network manager that manages the CPE.

[0023] CPE 102 comprises slice 118, which includes CPE resources 130. CPE resources 130 include interface 126 and network prefix(es) 140. CPE 102 also comprises slice 120, which includes CPE resources 132. CPE resources 132 include interface 128 and network prefix(es) 142. Interfaces 126 and 128 may be physical network interfaces such as Wi-Fi SSIDs or Ethernet ports, or virtual network interfaces, such as layer-4 VPNs or layer-3 tunnels. Network prefix(es) 140 and 142 may be Internet Protocol address prefixes that are assigned to their corresponding interfaces (e.g. network prefix(es) 140 may be assigned to interface 126 and network prefix(es) may be assigned to interface 128). A slice may include other CPE resources. For example, in embodiments where multiple slices share an interface, CPE resources 130 may include memory or bandwidth on interfaces that are shared with other slice services of CPE 102. "Token buckets" and other known mechanisms may be used to allocate a portion of resources to multiple resource consumers and guarantee each consumer gets a minimum share of the particular resource.

[0024] Each slice may be associated with a tenant application on the CPE that communicates with a secondary network manager that manages the slice. For example, slice 118 is associated with tenant app 104 and slice 120 is associated with tenant app 106. Tenant app 104 receives and responds to management communications from secondary network manager 114 and tenant app 106 receives and responds to management communications from secondary network manager 116. [0025] A tenant application may respond to management communications from a corresponding secondary network manager and may perform various management functions in relation to a corresponding slice as requested by the secondary network manager. For example, tenant app 104 may respond to management communications from secondary network manager 114 and may perform management functions at the request of secondary network manager 114. Management functions may include, but are not limited to, adding a name to a Wi-Fi SSID, configuring IEEE 802. lx on a Wi-Fi or Ethernet network interface, establishing an IPsec VPN between the CPE 102 and secondary network manager 114 or its data center. Other examples of management functions include "status" commands, including status commands to check the status of a network interface or the number or size of packets going through a logical or virtual network interface such as a VPN.

[0026] A slice may be allocated for a particular service and the secondary network manager that manages the tenant application associated with the slice may be operated by the service provider of the particular service. For example, slice 118 may be allocated for teleworking services and secondary network manager 114 may be operated by tenant service provider 122, which may be a provider of teleworking service such as a business enterprise.

[0027] Management communications received at CPE 102 may be routed to different slices of CPE 102 depending on which network interface the data is received at and which network prefix the data was addressed to. For example, secondary network manager 114 may send a management communication to manage slice 118. Once the management

communication is received at CPE 102, CPE 102 may route the management communication to tenant app 104 in slice 118 based on a determination that the communication is received at interface 126 and is addressed to any of network prefix(es) 140 or to the actual network address of tenant app 104.

[0028] Slicing client 108 may receive and execute slice provisioning instructions received from root network manager 112 at CPE 102. Slicing client 108 may provision one or more slices such as slice 118 and slice 120. In some embodiments, slicing client 108 may be configured to determine at least some CPE resources to allocate to a slice in response to a slice provisioning instructions based on availability of different CPE resources and/or the service for which the slice is being allocated. In other embodiments, root network manager 112 may identify to slicing client 108 each of the CPE resources to allocate to a slice and slicing client 108 may store data associating the identified CPE resources with the corresponding slice. [0029] Different tenant applications on a CPE may be obtained from different sources associated with the service providers to which the tenant applications correspond. For example, tenant app 104 may be obtained from tenant app provider 134, which is associated with tenant service provider 122, and tenant app 106 may be obtained from tenant app provider 136, which is associated with tenant service provider 124. In other embodiments, tenant applications may be obtained directly from their corresponding secondary network managers. For example, tenant app 104 may be obtained from secondary network manager 114 and tenant app 106 may be obtained from secondary network manager 116.

[0030] In some embodiments, tenant app 104 and/or tenant app 106 may be virtual machines. The use of virtual machines may allow the data in slices 118 and 120 to be isolated from the other slices that may be managed by different secondary network managers. The virtual machines may be user-mode virtual machine or kernel-mode virtual machines. In embodiments where tenant app 104 and tenant app 106 are virtual machines, other applications managed by secondary network manager 114 and secondary network manager 116 may operate within tenant app 104 and tenant app 106.

[0031] Communications between CPE 102 and root network manager 112, secondary network manager 114, and secondary network manager 116 may adhere to the Consumer Premises Equipment Wide Area Network Management Protocol (CWMP) TR-069 protocol, the Simple Network Management Protocol (SNMP) protocol, Network Configuration Protocol (NETCONF), or some other communication protocol.

[0032] FIG. 2 illustrates an example process of provisioning a slice of a CPE for a tenant application and managing of the tenant application by a secondary network manager. The process of FIG. 2 may be performed at CPE 102.

[0033] At block 210, CPE 102 receives, from a root network manager, a slice

provisioning instruction to provision a slice of the CPE for a tenant application, where the slice provisioning instruction identifies at least one network interface of one or more network interfaces of the CPE to allocate to the slice. In an embodiment, the slice provisioning instruction is a CWMP slice provisioning instruction that conforms to the CWMP /TR-069 protocol. The slice provisioning instruction may also adhere to the CWMP TR-098, TR-181, and/or TR-157 data model. In such an embodiment, root network manager 112, secondary network manager 114, and secondary network manager 116 may be auto configuration servers (ACS). In other embodiments, the slice provisioning instruction may adhere to a different management protocol. For example, in another embodiment, the slice provisioning instruction may adhere to the SNMP protocol and the Structure Management Information, SMIvl, or SMIv2 data model. In yet another embodiment, the slice provisioning instruction may adhere to NETCONF protocol and the YANG data model.

[0034] At block 220, in response to receiving the slice provisioning instruction, CPE 102 provisions the slice of the CPE, where provisioning the slice comprises allocating CPE resources including the at least one network interface to the slice of the CPE.

[0035] The slice provisioning instruction may also specify other CPE resources in addition to the network interfaces to allocate to the slice. In other embodiments, the instruction may specify only some of the CPE resources to allocate and slicing client 108 may determine at least some of the CPE resources to allocate to the slice based on availability. In another embodiment, the identification of resources to allocate to the slice may be communicated to the CPE from another entity such as a user device on a subscriber network to which the CPE 102 is connected.

[0036] In some embodiments, the amount and types of resources allocated to a slice may vary depending on the type of service the slice is being allocated for. For example, an entertainment service may require more bandwidth to be allocated to its corresponding slice than a home security service.

[0037] Root network manager 112 may send the slice provisioning instruction in response to receiving a request from a tenant service provider or at the request of a subscriber with whom CPE 102 is associated. For example, a subscriber of telecommunications service provider 138 may purchase home security services from tenant service provider 122. As a result, tenant service provider 122 or the subscriber may notify telecommunications service provider 138 to provision a slice of CPE 102 for management by secondary network manager 114, which is associated with tenant service provider 122.

[0038] In some embodiments, if CPE 102 has insufficient resources to allocate to a new slice, CPE 102 may indicate to root network manager 112 which resources are unavailable and may deny the slice provisioning instruction. If the slice provisioning instruction specified a set of resources to allocate to the new slice and a particular resource of the set of resources is not functioning properly, CPE 102 may indicate to root network manager 112 that the particular resource is not functioning properly and therefore cannot be allocated through a slice provisioning instruction.

[0039] At block 230, CPE 102 obtains the tenant application. A CPE host software at CPE 102 may obtain the tenant application from a remote network server. FIG. 3 and FIG. 4 illustrate example processes for obtaining the tenant application and are discussed further in other sections herein. [0040] At block 240, CPE 102 stores data associating the tenant application with the slice of the CPE. A table, mapping or other data structure maintained in volatile or non- volatile memory may be used to associate tenant applications with slices. In some embodiments, a tenant application only uses CPE resources that have been allocated to the slice of the CPE associated with the tenant application.

[0041] At block 250, CPE 102 receives, directly from a secondary network manager associated with the tenant application, a management instruction for managing the tenant application. At block 260, CPE 102 executes the management instruction only in relation to the slice. For example, CPE 102 may receive a management instruction for managing slice 118 directly from secondary network manager 114. CPE 102 may forward the management instruction directly to tenant app 104 associated with slice 118 and may not forward the management instruction to any other slices of CPE 102.

[0042] Secondary network manager 114 may send management instructions for the initial configuration of a slice and for the subsequent monitoring and configuration of the slice as appropriate.

[0043] During the initial configuration of a slice, the secondary network manager may specify network prefix(es) to associate with a slice's network interfaces. For example, secondary network manager 114 may configure slice 118 by providing, to tenant app 104, network prefix(es) to associate with interface 126. Similarly, secondary network manager 116 may configure tenant app 106 by providing network prefix(es) 140 to tenant app 106. The received network prefix(es) may be stored at CPE 102 in association with the corresponding slices and advertised on the slices' dedicated or shared network interfaces to hosts that use the network interfaces for communication.

[0044] Secondary network manager 114 may also specify particular policies for application to slice 118, such as forwarding policies or firewall policies that may be applied to data routed to slice 118. Secondary network managers 114 and 116 may configure their corresponding slice according to different policies depending on what type of service provider the secondary network manager is associated with. For example, slices associated with a teleworking service provider may have different forwarding policies than a slice associated with an entertainment service provider.

[0045] Management communications may be received at CPE 102 from any of root network manager 112, secondary network manager 114, and secondary network manager 116. In some embodiments, a management communication is routed to a corresponding slice based on the network interface at which the management communication was received and the network prefix used in the address to which the management communication was directed. For example, a management instruction may be routed to tenant app 104 in slice 118 if the instructions is received at interface 126 and the management instruction is addressed to an addresses that includes at least one network prefix of network prefix(es) 140.

[0046] Other slices may be provisioned by root network manager 112 on CPE 102 and configured by other secondary network managers associated with other tenant service providers. For example, after the provisioning and configuring of slice 118, root network manager 112 may provision slice 120 and secondary network manager 116, which is associated with tenant service provider 124, may configure slice 120. Secondary network managers 114 and 116 may manage their respective slices of CPE 102 and the respective tenant applications that are associated with those slices. Root network manager 112 may manage aspects of CPE 102 other than tenant app 104, tenant app 106, and the CPE resources included in slices 118 and 120.

[0047] FIG. 3 illustrates an example process of a CPE obtaining a tenant application. The process of FIG. 3 may be performed at CPE 102. At block 310, CPE 102 receives contact information for a tenant application provider from which to obtain the tenant application. The contact information may include, for example, an address of the tenant application provider such as a Uniform Resource Identifier (URL) or IP address.

[0048] The tenant application provider may be tenant app provider 134, from which tenant app 104 may be obtained. CPE 102 may receive the contact information for tenant app provider 134 from a root network manager 112. For example, root network manager 112 may include contact information for tenant app provider 134 in a slice provisioning request to CPE 102 for the provisioning of slice 118. In other embodiments, CPE 102 may receive the contact information for tenant app provider 134 from a separate device, such as a user device on a subscriber network to which the CPE 102 is connected.

[0049] At block 320, CPE 102 sends a request for a tenant application to the tenant application provider and obtains the tenant application. CPE 102 may send a request for tenant app 104 to tenant app provider 134. In other embodiments, tenant app 104 may be received at CPE 102 without CPE 102 having to send a request.

[0050] In some embodiments, at block 330, CPE 102 may also receive contact information for a secondary network manager from the user, web application program or even from the root manager. At block 340, using the contact information for secondary network manager 114, CPE 102 initiates communication with the secondary networking manager or authenticate communication from the secondary network manager. [0051] CPE 102 may receive the contact information for secondary network manager 114 from tenant application provider 134. The contact information may be delivered with the tenant app 104.

[0052] As used herein, the contact information that CPE 102 receives for the secondary network manager is information that is used to enable communication between the CPE and the secondary network manager. For example, the contact information may be used by CPE 102 to initiate communication with the secondary network manager (e.g. an address to which CPE 102 may send communication) or authenticate communications received from the secondary network manager (e.g. a private key).

[0053] For example, CPE 102 may send a request for configuration of tenant app 104 to the address of secondary network manager 114. In another embodiment, the contact information for secondary network manager 114 may include a private key that is used to authenticate secondary network manager 114. Secondary network manager 114 may provide a certificate that encapsulates a public key associated with secondary network manager 114 to CPE 102 before or with management communications. CPE 102 may only accept the management communications from secondary network manager 114 after authenticating secondary network manager 114 based on the public key provided by secondary network manager 114 and the private key obtained from tenant app provider 134.

[0054] In another embodiment, CPE 102 may communicate with a secondary network manager 114 before communicating with tenant app provider 134. FIG. 4 illustrates another example process of obtaining a tenant application. The process of FIG. 4 may be performed at CPE 102.

[0055] At block 410, CPE 102 receives contact information for a secondary network manager. The contact information for the secondary network manager may be received from a root network manager. For example, root network manager 112 may include contact information for secondary network manager 114 in a slice provisioning request to CPE 102 for the provisioning of slice 118. In other embodiments, CPE 102 may receive the contact information for secondary network manager 114 from a separate device, such as a user device on a subscriber network to which CPE 102 is connected or a web application that

communicates with CPE 102.

[0056] At block 420, CPE 102 obtains, from the secondary network manager, contact information for a tenant application provider from which to obtain the tenant application. The contact information for a tenant application provider may be, for example, the address of the tenant application provider or a public key for the tenant application provider. [0057] At block 430, CPE 102 obtains, using the contact information for the tenant application provider, the tenant application from the tenant application provider. For example, if the contact information for the tenant application provider is an address, CPE 102 may send a request for the tenant application to the received address.

[0058] In some embodiments, CPE 102 may specify properties of CPE 102 and the newly provisioned slice that is to be associated with a tenant application when requesting the tenant application. For example, the request for a tenant application sent by CPE 102 to tenant app provider 134 may identify the operating system of CPE 102 and the resources allocated to slice 118, such as the interfaces allocated to slice 118. Tenant app provider 134 may select a tenant app to send to CPE 102 based on the identified properties of CPE 102 or slice 118. For example, if tenant app provider 134 determines that the operating system of CPE 102 can support kernel- mode virtualization, tenant app provider 134 may send a virtual machine that uses kernel-mode virtualization.

[0059] In other embodiments, the tenant application may be obtained from the same secondary network manager that will manage the tenant application instead of a separate tenant app provider.

[0060] According to various embodiments, one or more of the steps of the processes illustrated in FIG. 2, FIG. 3, and FIG. 4 may be removed or the ordering of the steps may be changed. Additionally, although separate embodiments are discussed herein, any combination of embodiments and/or partial embodiments discussed herein may be combined to form further embodiments.

[0061] Based on the foregoing, it will be apparent that embodiments provide numerous benefits and have numerous technical effects. For example, an approach where secondary network manager 114 directly configures and otherwise manages slice 118 of CPE 102 offers many advantages over other approaches, such as approaches where root network manager 112 configures and manages CPE 102 or secondary network manager 114 routes its communications through root network manager 112. By secondary network manager 114 directly configuring and otherwise managing slice 118, secondary network manager 114 is able to retain a greater amount of control over the management of slice 118 while also keeping data sent to and from slice 118 private from root network manager 112.

[0062] Embodiments provide numerous benefits over prior practice. Multi-tenancy is known in data centers where a data center (DC) operator sells a service to a DC customer to run a virtual machine (VM) on a DC server. Numerous commercial providers may offer DC hosting to customers who run web sites or other services from the operator's DC rather than operating their own. The DC operator may also offer virtual networking services to better isolate customer data and traffic. In the DC case, there is a two-party customer relationship between DC operator and its customer, which may be governed by a service-level agreement for customer confidentiality and isolation of resident data and traffic. Unlike in the DC, the home network has multi-party relationships: In addition to ISP networking services, users can subscribe to other services offered by other service providers such as services for

teleworking, home security, connected energy, home automation, etc. These services can benefit from a multi-manager model. In a multi-manager model, a root network manager (which may be operated by an ISP or a retail user) may cooperate with a tenant network manager (which may be operated by a third-party service provider) on a network such as a home, small office/home office (SOHO), or small/medium business (SMB) network. How the root network manager provisions and tenant network managers configure and share a router for their services is one aspect of the present disclosure.

[0063] Thus, there may be three parties in home network services: (1) the home user, (2) an ISP, and (3) any other provider of a home-network service such as teleworking, home security, and etc. Typically the user buys services from the ISP and possibly other service providers. These relationships pose problems to existing management methods where there is a manager and a client in a strictly two-party relationship. Two-party provisioning, configuration and management standards such as TR-069/CWMP do not support multiple managers where a secondary network manager trusts the root network manager to properly provision tenant services on CPE routers, and the root network manager trusts the secondary network manager to properly configure its service on the root network manager's router. Strong isolation and confidentiality may be desired. For example, teleworking enterprises may refuse to share a CPE with others if doing so risks exposure of enterprise data to non- employees.

[0064] One approach of using a two-party management arrangement for one or more third parties consists of a root network manager to offering an interface to one or more secondary network managers; the root network manager may virtualize a CPE to the secondary network manager by presenting itself as a CPE to the secondary network manager. This approach may support multiple secondary network managers but without privacy or isolation for the secondary network manager. The root network manager would have visibility into the secondary network manager's action and the parts of the device that the secondary network manager manages. In certain embodiments, the root network manager may be a TR-069 auto-configuration server (ACS) that virtualizes a CPE router for secondary network managers. In such an embodiment, the root network manager relays all commands between the secondary network managers and parts of the CPE that are managed by the secondary network managers such as a CPE interfaces. Thus, the primary manager has total visibility into all exchanges between the secondary network manager and the CPE, which may be undesirable to the entity that operates the secondary network manager. Certain approaches described herein improve upon this by isolating service configuration and management from the root manager and other services.

[0065] Approaches described herein may offer separation and isolation for each tenant application and corresponding secondary network manager. In an embodiment, each secondary network manager may communicate with a corresponding virtual machine or other application on the CPE that comprises its own client management agent. The client management agent may communicate with the secondary network manager directly and unmediated through any other management entity. In an embodiment, each slice of the CPE includes a VM with a CWMP agent that communicates with a corresponding secondary network manager using the CWMP protocol. The VMs may be hosted on a computer such as a CPE router that itself is managed by a root network manager. The root network manage may provision a slice of the CPE for a particular tenant network manager. An embodiment extends the TR-069 protocol to include a provisioning function. In an embodiment, a root network manager performs slicing by allocating router interfaces for a secondary network manager but the root network manager is not involved in configuring the interfaces uses by a tenant application, which has a separate secondary network manager. The secondary network manager may configure the interfaces associated with its corresponding slice of the CPE. Data and traffic from the secondary network manager to the tenant app may be isolated from the root network manager and other network managers.

[0066] In the retail case, where a CPE is personally owned rather than owned by an ISP, a slicing client may run on the router and authenticate the user before executing provisioning requests from a user device or a proxy for the user. In such a case, the root network manager may be a user device that does not monitor availability of difference CPE resources. In such an embodiment, a slicing client at the CPE may select CPE resources to allocate to a CPE interface. A slicing client may also select CPE resources for allocation used in other embodiments, such as embodiments where the CPE is owned by an ISP.

[0067] In the place of a single network manager model, embodiments may include a multiple network manager model with isolation of management actions; an embodiment uses virtual machines on the router to achieve privacy and isolation on the device itself. A root network manager may provision router interfaces and other resources to slices and manage the router but may have practically no visibility as to how a tenant network manager configures its slice of router resources, which may be appropriate for teleworking, home security, and other services that are often governed by high-security policies. Benefits of certain embodiments over prior practice may include but are not limited to: (1) Router resources being be shared among multiple managers, which may be useful in unmanaged home networks, SOHO networks, and SMB networks; (2) each network manager's configuration and management operations being isolated from all the other network managers; (3) each router having a root network manager with access to the host device, but the visibility of the router to the root network manager being limited to provisioning not configuration or management of applications in the corresponding router slice.

[0068] 3.0 IMPLEMENTATION MECHANISMS - HARDWARE OVERVIEW

[0069] According to one embodiment, the techniques described herein are implemented by one or more special-purpose computing devices. The special-purpose computing devices may be hard- wired to perform the techniques, or may include digital electronic devices such as one or more application- specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs) that are persistently programmed to perform the techniques, or may include one or more general purpose hardware processors programmed to perform the techniques pursuant to program instructions in firmware, memory, other storage, or a combination. Such special-purpose computing devices may also combine custom hard- wired logic, ASICs, or FPGAs with custom programming to accomplish the techniques. The special-purpose computing devices may be desktop computer systems, portable computer systems, handheld devices, networking devices or any other device that incorporates hard- wired and/or program logic to implement the techniques.

[0070] FIG. 5 is a block diagram that illustrates a computer system 500 upon which an embodiment may be implemented. The preferred embodiment is implemented using one or more computer programs running on a network element such as a router device. Thus, in this embodiment, the computer system 500 is a router.

[0071] Computer system 500 includes a bus 502 or other communication mechanism for communicating information, and a processor 504 coupled with bus 502 for processing information. Computer system 500 also includes a main memory 506, such as a random access memory (RAM), flash memory, or other dynamic storage device, coupled to bus 502 for storing information and instructions to be executed by processor 504. Main memory 506 also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor 504. Computer system 500 further includes a read only memory (ROM) 508 or other static storage device coupled to bus 502 for storing static information and instructions for processor 504. A storage device 510, such as a magnetic disk, flash memory or optical disk, is provided and coupled to bus 502 for storing information and instructions.

[0072] A communication interface 518 may be coupled to bus 502 for communicating information and command selections to processor 504. Interface 518 is a conventional serial interface such as an RS-232 or RS-522 interface. An external terminal 512 or other computer system connects to the computer system 500 and provides commands to it using the interface 518. Firmware or software running in the computer system 500 provides a terminal interface or character-based command interface so that external commands can be given to the computer system.

[0073] A switching system 516 is coupled to bus 502 and has an input interface 514 and an output interface 519 to one or more external network elements. The external network elements may include a local network 522 coupled to one or more hosts 524, or a global network such as Internet 528 having one or more servers 530. The switching system 516 switches information traffic arriving on input interface 514 to output interface 519 according to pre- determined protocols and conventions that are well known. For example, switching system 516, in cooperation with processor 504, can determine a destination of a packet of data arriving on input interface 514 and send it to the correct destination using output interface 519. The destinations may include host 524, server 530, other end stations, or other routing and switching devices in local network 522 or Internet 528.

[0074] An embodiment is related to the use of computer system 500 for detecting prefixes for multihomed sites and computing backup paths. According to one embodiment, the techniques described herein are provided by computer system 500 in response to processor 504 executing one or more sequences of one or more instructions contained in main memory 506. Such instructions may be read into main memory 506 from another computer- readable medium, such as storage device 510. Execution of the sequences of instructions contained in main memory 506 causes processor 504 to perform the process steps described herein. One or more processors in a multi-processing arrangement may also be employed to execute the sequences of instructions contained in main memory 506. In alternative embodiments, hard- wired circuitry may be used in place of or in combination with software instructions to implement the disclosure. Thus, embodiments of the disclosure are not limited to any specific combination of hardware circuitry and software. [0075] The term "computer-readable medium" as used herein refers to any non-transitory media that store data and/or instructions that cause a machine to operation in a specific fashion. Such storage media may comprise non- volatile media and/or volatile media. Nonvolatile media includes, for example, optical or magnetic disks, such as storage device 510. Volatile media includes dynamic memory, such as main memory 506. Common forms of storage media include, for example, a floppy disk, a flexible disk, hard disk, solid state drive, magnetic tape, or any other magnetic data storage medium, a CD-ROM, any other optical data storage medium, any physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, NVRAM, any other memory chip or cartridge.

[0076] Common forms of computer-readable storage media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, a CD- ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, any other memory chip or cartridge, or any other tangible storage medium from which a computer can read.

[0077] Various forms of computer readable storage media may be involved in carrying one or more sequences of one or more instructions to processor 504 for execution. For example, the instructions may initially be carried on a magnetic disk of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to computer system 500 can receive the data on the telephone line and use an infrared transmitter to convert the data to an infrared signal. An infrared detector coupled to bus 502 can receive the data carried in the infrared signal and place the data on bus 502. Bus 502 carries the data to main memory 506, from which processor 504 retrieves and executes the instructions. The instructions received by main memory 506 may optionally be stored on storage device 510 either before or after execution by processor 504.

[0078] Communication interface 518 also provides a two-way data communication coupling to a network link 520 that is connected to a local network 522. For example, communication interface 518 may be an integrated services digital network (ISDN) card or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, communication interface 518 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation, communication interface 518 sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information. [0079] Network link 520 typically provides data communication through one or more networks to other data devices. For example, network link 520 may provide a connection through local network 522 to a host computer 524 or to data equipment operated by an Internet Service Provider (ISP) 526. ISP 526 in turn provides data communication services through the world wide packet data communication network now commonly referred to as the "Internet" 528. Local network 522 and Internet 528 both use electrical, electromagnetic or optical signals that carry digital data streams. The signals through the various networks and the signals on network link 520 and through communication interface 518, which carry the digital data to and from computer system 500, are exemplary forms of carrier waves transporting the information.

[0080] Computer system 500 can send messages and receive data, including program code, through the network(s), network link 520 and communication interface 518. In the Internet example, a server 530 might transmit a requested code for an application program through Internet 528, ISP 526, local network 522 and communication interface 518. In accordance with an embodiment, one such downloaded application provides for fast convergence as described herein.

[0081] The received code may be executed by processor 504 as it is received, and/or stored in storage device 510, or other no n- volatile storage for later execution. In this manner, computer system 500 may obtain application code in the form of a carrier wave.

[0082] 4.0 EXTENSIONS AND ALTERNATIVES

[0083] In the foregoing specification, embodiments of the disclosure have been described with reference to numerous specific details that may vary from implementation to

implementation. Thus, the sole and exclusive indicator of what is the disclosure, and is intended by the applicants to be the disclosure, is the set of claims that issue from this application, in the specific form in which such claims issue, including any subsequent correction. Any definitions expressly set forth herein for terms contained in such claims shall govern the meaning of such terms as used in the claims. Hence, no limitation, element, property, feature, advantage or attribute that is not expressly recited in a claim should limit the scope of such claim in any way. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.

Claims

CLAIMS What is claimed is:

1. A method comprising:

at a customer premises equipment (CPE) comprising one or more network interfaces: receiving, from a root network manager, a slice provisioning instruction to provision a slice of the CPE for a tenant application, wherein the slice provisioning instruction identifies at least one network interface of the one or more network interfaces to allocate to the slice; provisioning the slice of the CPE, wherein provisioning the slice comprises allocating CPE resources including the at least one network interface to the slice of the customer premises equipment;

obtaining the tenant application;

store data associating the tenant application with the slice of the CPE;

receiving, directly from a secondary network manager associated with the tenant application, a management instruction for managing the tenant application;

executing the management instruction only in relation to the slice.

2. The method of Claim 1 wherein the tenant application is a particular virtual machine;

wherein the method further comprises executing the management instruction only in relation to the particular virtual machine in isolation from other virtual machines in other slices of the CPE different than the slice.

3. The method of Claim 1 wherein the secondary network manager is associated with a service provider that is not associated with the root network manager.

4. The method of Claim 1 wherein the tenant application is one of a plurality of different tenant applications at the CPE, wherein each tenant application of the plurality of different tenant applications is associated with a different slice of the CPE and a different secondary network manager of a plurality of secondary network managers.

5. The method of Claim 4 wherein the root network manager is associated with an internet service provider and the secondary network manager is associated with a service provider that is different than the internet service provider and is of one or more of a teleworking service provider, a home security service provider, a home automation service provider, or an entertainment service provider.

6. The method of Claim 1 further comprising:

receiving, from the root network manager, contact information for a tenant application provider;

obtaining, from the tenant application provider, the tenant application and contact information for the secondary network manager.

7. The method of Claim 6 further comprising:

receiving, from the root network manager, contact information for the secondary network manager;

obtaining, from the secondary network manager, contact information for the tenant application provider;

obtaining, from the tenant application provider, the tenant application.

8. The method of Claim 1 further comprising:

receiving, from the secondary network manager, configuration instructions for configuring the tenant application, wherein the configuration instructions for configuring the tenant application specify one or more network prefixes to associate with the at least one network interfaces.

9. The method of Claim 1 further comprising:

determining, at the customer premises equipment, particular CPE resources to include in the slice, wherein the root network manager does not identify the particular CPE resources for inclusion in the slice.

10. The method of Claim 1 further comprising:

receiving, from the root network manager, an identification of particular CPE resources to include in the slice.

11. A consumer premises equipment (CPE) comprising:

one or more processors;

one or more network interfaces; one or more non-transitory computer storage media coupled to the one or more processors and comprising one or more sequences of instructions which, when executed by the one or more processors, cause performing:

at a customer premises equipment (CPE) comprising one or more network interfaces, receiving, from a root network manager, a slice provisioning instruction to provision a slice of the CPE for a tenant application, wherein the slice provisioning instruction identifies at least one network interface of the one or more network interfaces to allocate to the slice; provisioning the slice of the CPE, wherein provisioning the slice comprises allocating CPE resources including the at least one network interface to the slice of the customer premises equipment;

obtaining the tenant application;

store data associating the tenant application with the slice of the CPE;

executing the management instruction only in relation to the slice.

12. The CPE of Claim 11 wherein the tenant application is a particular virtual machine;

wherein the instructions comprise additional instructions which, when executed, cause performing: executing the management instruction only in relation to the particular virtual machine in isolation from other virtual machines in other slices of the CPE different than the slice.

13. The CPE of Claim 11 wherein the secondary network manager is associated with a service provider that is not associated with the root network manager.

14. The CPE of Claim 11 wherein the tenant application is one of a plurality of different tenant applications at the CPE, wherein each tenant application of the plurality of different tenant applications is associated with a different slice of the CPE and a different secondary network manager of a plurality of secondary network managers.

15. The CPE of Claim 14 wherein the root network manager is associated with an internet service provider and the secondary network manager is associated with a service provider that is different than the internet service provider and is of one or more of a teleworking service provider, a home security service provider, a home automation service provider, or an entertainment service provider.

16. The CPE of Claim 11 wherein the instructions further comprise additional instructions which, when executed, cause performing:

17. The CPE of Claim 16 wherein the instructions further comprise additional instructions which, when executed, cause performing:

obtaining, from the tenant application provider, the tenant application.

18. The CPE of Claim 11 wherein the instructions further comprise additional instructions which, when executed, cause performing:

19. The CPE of Claim 11 wherein the instructions further comprise additional instructions which, when executed, cause performing:

20. The CPE of Claim 11 wherein the instructions further comprise additional instructions which, when executed, cause performing: receiving, from the root network manager, an identification of particular CPE resources to include in the slice.

21. One or more no n- transitory computer-readable storage media comprising one or more sequences of instructions which when executed cause one or more processors to perform:

at a customer premises equipment (CPE) comprising one or more network interfaces, receiving, from a root network manager, a slice provisioning instruction to provision a slice of a customer premises equipment (CPE) for a tenant application, wherein the slice provisioning instruction identifies at least one network interface of the one or more network interfaces to allocate to the slice;

provisioning the slice of the CPE, wherein provisioning the slice comprises allocating CPE resources including the at least one network interface to the slice of the customer premises equipment;

obtaining the tenant application;

store data associating the tenant application with the slice of the CPE;

executing the management instruction only in relation to the slice.